# Rsyslog

## Create topic

Click on "Create topic".

## Enable syslog protocol ingestion in topic configuration

Click on "Enable syslog" and write down port number. 


## Download CA certificates

Download the CA certificate bundle and place it in `/etc/rsyslog.cacert.pem`

```
sudo curl https://curl.se/ca/cacert.pem -o /etc/rsyslog.cacert.pem
```

## Add Loglark export to rsyslog configuration


First, you need to locate configuration directory for rsyslog. Modern
installations usually support including configuration parts from
`/etc/rsyslog.d` on Linux systems or `/usr/local/etc/syslog.d` on
FreeBSD. If your system has such a directory, then place the following
snippet into it.

Otherwise you would need to edit rsyslog configuration directly. It is
usually located at `/etc/rsyslog.conf` or
`/usr/local/etc/rsyslog.conf`. Add the snippet to the end of
configuration file.

Replace XXXX with port number you've got earlier.

```
*.*     action(
                type="omfwd"
                target="feeder.loglark.io"
                port="XXXX"
                protocol="tcp"
                StreamDriver="gtls"
                StreamDriverMode="1"
                StreamDriverAuthMode="x509/name"
                StreamDriverPermittedPeers="*.loglark.io"
                streamDriver.CAFile="/etc/rsyslog.cacert.pem"
                action.resumeRetryCount="100"
                queue.type="linkedList"
                queue.size="10000"
	)
```

## Ensure that rsyslog supports encryption


For Debian based distros ensure that `rsyslog-gnutls` package is installed:

```
sudo apt install rsyslog-gnutls
```

For RedHat derivatives:

```
sudo yum install rsyslog-gnutls
```


## Restart rsyslog

```
sudo service rsyslog restart
```